6 ms·

Apart from being a horrific bug, why are people running npm as root? Why don't they install it somewhere below $HOME and modify $PATH? npm is working fine witho

by foepys 9y ago

Apart from being a horrific bug, why are people running npm as root? Why don't they install it somewhere below $HOME and modify $PATH? npm is working fine without root permissions. Everything is super dangerous as root, one should avoid using root at all costs until there is no other way.

tbranyen 9y ago
Because sometimes you are writing software that interacts with hardware at a root level. This is really annoying advice you're giving since its absolute and without context. No, not everything is "super dangerous" with sudo. Get that FUD outta here!
- diggan 9y ago
  npm should never interact with hardware, it's job is to install and manage packages. I could understand that you have to run nodejs with root, since it actually can use the hardware. But using npm with root user? I can't think of a single usecase.
  - tbranyen 9y ago
    Well think harder. Npm runs scripts from package.json. Most folks wouldn't think twice to run sudo npm start as a replacement for sudo node. I sure wouldn't think npm would start mucking with file permissions.
    - diggan 9y ago
      I'm sorry but that people can't figure out where to put `sudo` is not a usecase for using sudo... Instead of running `sudo npm start`, have `scripts.start` have the value `sudo node index.js` if you want. But then again, I'm not "most folks", I try to think when I am the root user and don't run third-party code willy-nilly when I am.
  - chopin 9y ago
    I am not a node guy but as far as I understand nodejs is a webserver, no? _Never_ run any webserver as root. This is just bad practice.
    - manigandham 9y ago
      No, Node is a runtime for javascript code, using the same V8 engine from the Chrome browser. It is similar to the JVM runtime for Java code and the CLR for C#, although of course there is no intermediate compilation step for javascript. A webserver is one of many things that can be run using Node+JS, the point being that it's an entire runtime and can do pretty much anything any other language can do.
- yorwba 9y ago
  The reason raw hardware access is limited to root is usually because it's "super dangerous", i.e. the consequences of your actions can be more far-reaching than usual and mistakes might have you lose more than just time.
- breatheoften 9y ago
  Running npm as root is _super dangerous_ - full stop. npm install can run a large amount of arbitrary code downloaded from the internet via postinstall script hooks. Its absolutely banana-pants crazy to run `npm install` as a root user in any circumstance.
  - rad88 9y ago
    It's banana-pants crazy to run npm at all. Even given all the wisdom about running as sudo, best practices etc., this team released an update where `sudo npm --help` breaks the operating system. The recklessness and confusion of ideas that indicates... postinstall hooks, I don't even want npm running. This isn't even the first such shenanigans.
  - xorcist 9y ago
    If it runs untrusted code from the Internet, surely it doesn't matter much if you do it as root for most practical purposes? It could still run that spam relay, botnet software, exfiltrate your secrets and install that keylogger.
    - breatheoften 9y ago
      Is your argument that one is better off to run $(potentially dangerous command) with sudo privileges because it’s also risky to run it without?
  - saurik 9y ago
    Yeah, it would really suck if those files installed by my operating system--the ones that are trivially verified and easily replaced as they are literally the same on every single computer--were to be damaged. Things are much safer if I run them as the user which owns all of my data and which I spend all my time logged in as, right? I mean, at least I haven't stupidly added any part of my home directory to my path, so I can trust that the software I am running was installed by someone running as root... oh wait :/. The only reason root even exists on a computer that has two users (root and the user that owns all the data) is to make sure that no software is installed on the system except by root. If you have things set up to also let you install software as the user that isn't root, then you have somehow missed the entire point of peiviledge separation and should just log in as root and do everything as root, as that is at that point fully equivalent.
- mbrumlow 9y ago
  Right, but that means your service is running with elevated privileges, that does not mean your build tool needs too. Furthermore if you do have a application that requires root level access then the parts that do should be isolated from the parts that don't. You don't get to just get a blank check to run as root because you need to bind to a low port.
carussell 9y ago
`sudo npm install -g` is one of several examples of the normalization of deviance rife in the NodeJS community. Most command-line utilities distributed through NPM recommend running as root (implicitly—because they all suggest installing it as a global package). Here's[1] Microsoft's instructions to install the TypeScript compiler, for example. NPM's awfulness notwithstanding, it's trivial to write a shell script to do what you say and add a symlink to ~/bin. But everyone on StackOverflow will tell each other "just run it with sudo", and they do, and then quickly move on with their lives (presumably to be followed with "and break things"). Instead of doing the right thing, raising their hackles about how poorly NPM is designed, and holding its community leaders accountable. 1. https://github.com/Microsoft/TypeScript/blob/b29e0c9e3ab247199eed6b69674a2c992c3a05a6/README.md#installing https://github.com/Microsoft/TypeScript/blob/b29e0c9e3ab2471...
- CJefferson 9y ago
  If I run npm without -g, it complains about missing files, and fills my home directory with node_modules junk and a package-lock.json I have to "commit"? Why do I want to commit it, and where? I'm sure you are now going to tell me there is an easy way to fix that too, and I'd be happy if there was, but for me I just want to use npm to install a program or two.
  - carussell 9y ago
    > for me I just want to use npm to install a program or two. I don't think you're introducing new information. When I wrote my original comment, it was intended to fully acknowledge that this is what's at play. And rereading it, seems like it does that well enough, but I might be wrong. But in any case, I'll run it with sudo then, is absolutely the wrong thing to do, regardless of the bad choices on NPM's part—on par with I just want to use my online banking, so I'll click through this certificate error, or I just want to take some notes, so I'll grant this mobile app the full permissions it's asking for. There's a reason I used the phrase "normalization of deviance". It's a phrase that came out of post mortem investigations into simple process failures at NASA that led to proper (catastrophic, life-ending) failures, and an urge to find an answer to the question, "how in the world did we get here?"
deleted 9y ago
[deleted]
tachyoff 9y ago
I know a lot of inexperienced devs who run things as root to try to fix problems. It’s the first thing some of them do (after restarting). I think it’s a lack of awareness due to missing knowledge. When you don’t know much about how your system works, you can’t effectively troubleshoot it.

by foepys 9y ago

tbranyen 9y ago

Because sometimes you are writing software that interacts with hardware at a root level. This is really annoying advice you're giving since its absolute and without context. No, not everything is "super dangerous" with sudo. Get that FUD outta here!

diggan 9y ago
npm should never interact with hardware, it's job is to install and manage packages. I could understand that you have to run nodejs with root, since it actually can use the hardware. But using npm with root user? I can't think of a single usecase.
- tbranyen 9y ago
  Well think harder. Npm runs scripts from package.json. Most folks wouldn't think twice to run sudo npm start as a replacement for sudo node. I sure wouldn't think npm would start mucking with file permissions.
  - diggan 9y ago
    I'm sorry but that people can't figure out where to put `sudo` is not a usecase for using sudo... Instead of running `sudo npm start`, have `scripts.start` have the value `sudo node index.js` if you want. But then again, I'm not "most folks", I try to think when I am the root user and don't run third-party code willy-nilly when I am.
- chopin 9y ago
  I am not a node guy but as far as I understand nodejs is a webserver, no? _Never_ run any webserver as root. This is just bad practice.
  - manigandham 9y ago
    No, Node is a runtime for javascript code, using the same V8 engine from the Chrome browser. It is similar to the JVM runtime for Java code and the CLR for C#, although of course there is no intermediate compilation step for javascript. A webserver is one of many things that can be run using Node+JS, the point being that it's an entire runtime and can do pretty much anything any other language can do.
yorwba 9y ago
The reason raw hardware access is limited to root is usually because it's "super dangerous", i.e. the consequences of your actions can be more far-reaching than usual and mistakes might have you lose more than just time.
breatheoften 9y ago
Running npm as root is _super dangerous_ - full stop. npm install can run a large amount of arbitrary code downloaded from the internet via postinstall script hooks. Its absolutely banana-pants crazy to run `npm install` as a root user in any circumstance.
- rad88 9y ago
  It's banana-pants crazy to run npm at all. Even given all the wisdom about running as sudo, best practices etc., this team released an update where `sudo npm --help` breaks the operating system. The recklessness and confusion of ideas that indicates... postinstall hooks, I don't even want npm running. This isn't even the first such shenanigans.
- xorcist 9y ago
  If it runs untrusted code from the Internet, surely it doesn't matter much if you do it as root for most practical purposes? It could still run that spam relay, botnet software, exfiltrate your secrets and install that keylogger.
  - breatheoften 9y ago
    Is your argument that one is better off to run $(potentially dangerous command) with sudo privileges because it’s also risky to run it without?
- saurik 9y ago
  Yeah, it would really suck if those files installed by my operating system--the ones that are trivially verified and easily replaced as they are literally the same on every single computer--were to be damaged. Things are much safer if I run them as the user which owns all of my data and which I spend all my time logged in as, right? I mean, at least I haven't stupidly added any part of my home directory to my path, so I can trust that the software I am running was installed by someone running as root... oh wait :/. The only reason root even exists on a computer that has two users (root and the user that owns all the data) is to make sure that no software is installed on the system except by root. If you have things set up to also let you install software as the user that isn't root, then you have somehow missed the entire point of peiviledge separation and should just log in as root and do everything as root, as that is at that point fully equivalent.
mbrumlow 9y ago
Right, but that means your service is running with elevated privileges, that does not mean your build tool needs too. Furthermore if you do have a application that requires root level access then the parts that do should be isolated from the parts that don't. You don't get to just get a blank check to run as root because you need to bind to a low port.

carussell 9y ago

`sudo npm install -g` is one of several examples of the normalization of deviance rife in the NodeJS community. Most command-line utilities distributed through NPM recommend running as root (implicitly—because they all suggest installing it as a global package). Here's[1] Microsoft's instructions to install the TypeScript compiler, for example. NPM's awfulness notwithstanding, it's trivial to write a shell script to do what you say and add a symlink to ~/bin. But everyone on StackOverflow will tell each other "just run it with sudo", and they do, and then quickly move on with their lives (presumably to be followed with "and break things"). Instead of doing the right thing, raising their hackles about how poorly NPM is designed, and holding its community leaders accountable. 1. https://github.com/Microsoft/TypeScript/blob/b29e0c9e3ab247199eed6b69674a2c992c3a05a6/README.md#installing https://github.com/Microsoft/TypeScript/blob/b29e0c9e3ab2471...

CJefferson 9y ago
If I run npm without -g, it complains about missing files, and fills my home directory with node_modules junk and a package-lock.json I have to "commit"? Why do I want to commit it, and where? I'm sure you are now going to tell me there is an easy way to fix that too, and I'd be happy if there was, but for me I just want to use npm to install a program or two.
- carussell 9y ago
  > for me I just want to use npm to install a program or two. I don't think you're introducing new information. When I wrote my original comment, it was intended to fully acknowledge that this is what's at play. And rereading it, seems like it does that well enough, but I might be wrong. But in any case, I'll run it with sudo then, is absolutely the wrong thing to do, regardless of the bad choices on NPM's part—on par with I just want to use my online banking, so I'll click through this certificate error, or I just want to take some notes, so I'll grant this mobile app the full permissions it's asking for. There's a reason I used the phrase "normalization of deviance". It's a phrase that came out of post mortem investigations into simple process failures at NASA that led to proper (catastrophic, life-ending) failures, and an urge to find an answer to the question, "how in the world did we get here?"

deleted 9y ago

[deleted]

tachyoff 9y ago

I know a lot of inexperienced devs who run things as root to try to fix problems. It’s the first thing some of them do (after restarting). I think it’s a lack of awareness due to missing knowledge. When you don’t know much about how your system works, you can’t effectively troubleshoot it.